Having been waiting for this for ages, the ability to use the (pretty robust and secure) audit structure in Linux to log traffic has been finally integrated into the kernel, together with its supporting files and extensions in iptables. Unfortunately, this would be available in .39 version and above of the kernel, which is quite a long way away.
The new AUDIT target logs the following elements of any traffic and is protocol independent (so it could be used equally well in iptables and ebtables): - netfilter hook - packet length - incomming/outgoing interface - MAC src/dst/proto for ethernet packets - src/dst/protocol address for IPv4/IPv6 - src/dst port for TCP/UDP/UDPLITE - icmp type/code This data is available through the audit daemon (auditd) and is also retrievable using standard audit tools (ausearch/aureport). I was able to bring all relevant code and integrate it into the .35 version of the kernel, together with the latest version of iptables (1.4.10) and conducted various tests over the past 2 days. It works a treat! The problem I am now having is that I had to be very "creative" and do some rather ugly hacks to integrate it into the test harness and thought that it would be better to ask here if I could replace the standard log mechanism on shorewall with the new AUDIT target? This is how it works (some very rudimentary example from the man page of the AUDIT target): iptables -N AUDIT_DROP iptables -A AUDIT_DROP -j AUDIT --type DROP iptables -A AUDIT_DROP -j DROP A rule which would typically drop a packet would then invoke the new chain to record packets before dropping them. The "--type" above has one function only - to indicate to the audit daemon the type of operation logged - one of: drop, reject or accept. Full logs are stored, securely, and these are retrievable, together with all security-related events on the system, using ausearch and aureport - no need to use anything else and since I use both tools extensively on all my systems here I could apply filters to the type of events I am interested in without having the need to look at all syslogs and such. So, is this doable in shorewall? ------------------------------------------------------------------------------ What Every C/C++ and Fortran developer Should Know! Read this article and learn how Intel has extended the reach of its next-generation tools to help Windows* and Linux* C/C++ and Fortran developers boost performance applications - including clusters. http://p.sf.net/sfu/intel-dev2devmay _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
